Superpower Daily

Superpower Daily

Your reading space

Sign in
DoorDash Automatically Labels AI-Enhanced Food Photos on Its Me...AI Data-Center Land Buying Hits $6 Billion as Rural Backlash Be...Saudi Ministry Backs Google AI Plus Access for 1 Million Univer...OpenAI Prepares Workspace Credits for Completed ChatGPT Plugin...Figma Uses Security Agents to Speed Complex Alert Response, Kee...Perplexity Details Its Embedding Stack but Leaves Production Ga...DoorDash Automatically Labels AI-Enhanced Food Photos on Its Me...AI Data-Center Land Buying Hits $6 Billion as Rural Backlash Be...Saudi Ministry Backs Google AI Plus Access for 1 Million Univer...OpenAI Prepares Workspace Credits for Completed ChatGPT Plugin...Figma Uses Security Agents to Speed Complex Alert Response, Kee...Perplexity Details Its Embedding Stack but Leaves Production Ga...
Swipe

Figma Uses Security Agents to Speed Complex Alert Response, Keeps Fixes as Drafts

Figma’s reported gains come from giving agents broad access to investigation data while keeping proposed code changes and sensitive Slack discussions under tighter controls.

By 2 min read
Figma Uses Security Agents to Speed Complex Alert Response, Keeps Fixes as Drafts
Figma Uses Security Agents to Speed Complex Alert Response, Keeps Fixes as Drafts

Listen to this story

The audio brief

About 1:26
0:001:26
Read transcript
Figma says its security agents are resolving complex alerts about 70 percent faster, while reducing on-call pages by 20 percent. The notable part is how broadly the system can investigate: it connects alert triage with historical incidents, cloud and identity logs, code repositories, and even a proposed fix. The agent works through Panther’s SIEM, checking records across AWS, Okta, GitHub, GCP, and osquery. It can also query more than 100 other sources, search Slack history, use stored investigation guidance, and open pull requests. That gives it a path from “what happened?” to “what might fix it?” without making those steps separate workflows. Figma says the broader system found more than 100 previously unknown vulnerabilities, including two critical flaws that traditional tools missed. Its code reviewer reached 80 percent precision within a month, and detection of known bugs improved by about 30 percent. But Figma has drawn a clear line around authority. Agent-created pull requests remain drafts, not ready-to-merge changes, and the system is designed to keep sensitive investigation details out of public Slack channels. The stack includes an Opus-like model, AWS Bedrock Knowledge Bases, Amazon Kendra, Tines, and Snowflake-backed search. Figma says the right balance between automation and human approval is still evolving. That draft-only boundary is the key constraint to watch as these agents move from investigation toward remediation.

Story brief

3 key points

Figma is using security agents to connect alert triage with historical incidents, cloud and identity logs, code repositories, and proposed remediations. The company reports roughly 70% faster resolution for complex alerts and 20% fewer on-call pages, but keeps agent-generated pull requests as drafts and blocks sensitive investigation details from public Slack. The system spans Panther, AWS, Okta, GitHub, GCP, and...

  1. 01

    The agent can query more than 100 additional sources and use Slack history, steering memory, and tools scoped to security on-call work.

  2. 02

    Figma reports finding more than 100 previously unknown vulnerabilities, including two critical flaws missed by traditional tools.

  3. 03

    Its code reviewer reached 80% precision within a month, while known-bug detection improved about 30%.

Figma has put AI agents into security investigations that reach from alerts and historical incidents to company systems and proposed code fixes. The company says the system cut resolution time for complex alerts by about 70%, but it has kept agent-created pull requests in draft mode and added protections against sensitive information reaching public Slack channels.

An investigation layer across the security stack

The system uses Panther SIEM to investigate alerts and check audit logs across AWS, Okta, GitHub, GCP and osquery. It can query more than 100 additional sources and open pull requests, tying security triage to both the records needed for an investigation and a potential remediation path.

Figma says its alert-triage agent receives Slack-thread history, steering memory and tools scoped to normal security on-call tasks. It describes the model as one like Claude Opus; AWS Bedrock Knowledge Bases, Amazon Kendra, Tines and a Snowflake-based tool support searches of historical alerts and Panther data.

What the agent retains between investigations

  • Past alerts provide context from earlier cases.
  • Behavioral guidance steers how the agent conducts an investigation.
  • Learned database structures help it navigate the information it searches.

The authority boundary is built into the workflow

Figma has put constraints alongside the agent’s tools. Pull requests created by agents are drafts by default, rather than ready-to-merge changes, while prompts are designed to prevent sensitive investigation data from being shared in public Slack channels.

Broader security claims remain company-reported

In separate work, Figma reported that its agents found more than 100 previously unknown vulnerabilities, including two critical flaws missed by traditional tools. It also said its code reviewer reached 80% precision within a month, improved detection of known bugs by about 30%, and cut some coding errors by about 50% after automated guidance was added.

Those outcomes extend the case for using agents in security work, but they do not settle how much approval should remain with people. Figma acknowledges its agents are imperfect and says the appropriate balance between automation and human oversight is still evolving.

Sources

  1. infoq.comHow Figma Uses AI Agents for Security

Related coverage

Continue reading